I forgot to mention, the SessionManager singleton needs the same security
checks as the JNDI lookup, because otherwise the scripts could fake the login
of another user without requiring any creds.
On Wednesday, September 26, 2012 23:28:51 Lukas Krejci wrote:
Well, to be fair there isn't much docs on it apart from the code
;)
This was done during the alert notification scripts effort, documented here
https://docs.jboss.org/author/display/RHQ/Design+-+Serverside+scripts and
that page contains a whole 1 sentence about a need to run the scripts
securely on the server ;)
The gist of it is that we can't allow the scripts to a) shut down the server
and b) circumvent auth and authz.
Because they are running in the server itself, we need to make sure they
can't access the local SLSBs. At the same time, we need them to access the
local SLSBs because those guys do all the work ;)
The solution to the above problem is to guard the JNDI lookup by requiring a
certain Java permission. The alert scripts run in an access control context
that specifically lacks that permission and therefore the scripts cannot do
a JNDI lookup.
To allow them to interact with the server though, we specifically grant that
permission if the scripts use our "approved" gateway to the RHQ - the
remote interfaces.
It all starts with the AccessCheckingInitialContextFactoryBuilderInstaller
which is an MBean (that is installed into the container, see jboss-
service.xml).
That MBean installs the AccessCheckingInitialContextFactoryBuilder as the
initial context factory builder, so that we are in control of creation of
the initial context factories and can therefore inject our own security
checking code in there.
Because this stuff needs to be otherwise transparent, i.e. the callers need
to be able to cast the InitialContext impls returned from the factories to
various subclasses, it all gets a bit complex down the road.
But the important thing is that AS7 uses a different implementation of the
naming server - AS4 used the jnpserver while AS7 uses jboss.as.naming. That
implementation can use its JndiPermission class and we should try using that
for the same goals as above.
On Wednesday, September 26, 2012 16:44:58 John Mazzitelli wrote:
> Yeah, I know I keep saying I want to talk to you about this, but I never
> do
>
> :)
>
> We do have to talk about your JNDI stuff in container-lib - because right
> now, none of that is being used in the AS7 branch. Is there a write up you
> did that talks about this JNDI stuff (BZ?) - why it was necessary, where
> it
> is used and how to know if its broken or not?
>
> I'll add that to the checklist
>
> ----- Original Message -----
>
> > My usual pet peeve, alert notification scripts ;) Those should work
> > including
> > all the security features - i.e. the inability to do JNDI lookups on
> > the RHQ
> > server itself (but be able to do them remotely on other servers).
> > There is an
> > integration test for this in the integration-tests module.
> >
> > On Wednesday, September 26, 2012 16:35:00 John Mazzitelli wrote:
> > > I would like to ask for a consensus on what needs to be
> > > accomplished or
> > > "checked off the list" in order to consider merging the AS7
branch
> > > into
> > > master. What do you want to make sure is done/working before we
> > > move over
> > > to AS7 in master?
> > >
> > > For example:
> > >
> > > 1) Make sure the installer sets up the app server such that you can
> > > unzip
> > > and run the server 2) Make sure the application successfully
> > > deployed with
> > > no AS7 deployment errors 3) Make sure an agent can talk to the
> > > server (that
> > > is, make sure inventory can be committed and agent/server comm
> > > works) 4)
> > > Make sure the UI loads and you can log in
> > >
> > > We can cross off those items. This is not to say there are not
> > > still bugs
> > > in, say, the UI or elsewhere, but those basic things are done. But
> > > what
> > > about:
> > >
> > > 5) Be able to run all unit tests via "mvn test"
> > > 6) Make sure QA has run through all of their integration tests and
> > > all pass
> > > 7) Make sure the entire UI/server works just like the old app based
> > > on AS
> > > 4.2.3 8) Make sure the CLI runs and can execute everything that
> > > could
> > > execute before (Jay is working on this now) 9) Run performance
> > > testing
> > > 10) Make sure db upgrade and agent updating works
> > >
> > > ... etc...
> > >
> > > Those items are not done. Do those items need to be done before we
> > > start
> > > asking the entire team/community to start working with the new app
> > > server
> > > infrastructure? What other items should be on this list of "must do
> > > these
> > > first before we switch everyone over to AS7".
> > > _______________________________________________
> > > rhq-devel mailing list
> > > rhq-devel(a)lists.fedorahosted.org
> > >
https://lists.fedorahosted.org/mailman/listinfo/rhq-devel
> >
> > _______________________________________________
> > rhq-devel mailing list
> > rhq-devel(a)lists.fedorahosted.org
> >
https://lists.fedorahosted.org/mailman/listinfo/rhq-devel
>
> _______________________________________________
> rhq-devel mailing list
> rhq-devel(a)lists.fedorahosted.org
>
https://lists.fedorahosted.org/mailman/listinfo/rhq-devel
_______________________________________________
rhq-devel mailing list
rhq-devel(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/rhq-devel